kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Display key type with list and validate commands

Browse Source 
For the 'zkey list', 'zkey validate' and 'zkey-cryptsetup validate'
commands, display the key type.

As of today there is only one possible key type (CCA-AESDATA),
but in the future there might be additional key types.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-03-21 10:45:44 +01:00
committed by Jan Höppner
parent e15e8a1bfa
commit 9de85f4295
5 changed files with 67 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
zkey/keystore.c
View File

@@ -77,6 +77,7 @@ struct key_filenames {
#define REC_SEC_KEY_SIZE "Secure key size"
#define REC_CLR_KEY_SIZE "Clear key size"
#define REC_XTS "XTS type key"
#define REC_KEY_TYPE "Key type"
#define REC_VOLUMES "Volumes"
#define REC_APQNS "APQNs"
#define REC_KEY_FILE "Key file name"
@@ -2140,6 +2141,7 @@ static struct util_rec *_keystore_setup_record(bool validation)
util_rec_def(rec, REC_CLR_KEY_SIZE, UTIL_REC_ALIGN_LEFT, 20,
REC_CLR_KEY_SIZE);
util_rec_def(rec, REC_XTS, UTIL_REC_ALIGN_LEFT, 3, REC_XTS);
util_rec_def(rec, REC_KEY_TYPE, UTIL_REC_ALIGN_LEFT, 54, REC_KEY_TYPE);
if (validation)
util_rec_def(rec, REC_MASTERKEY, UTIL_REC_ALIGN_LEFT, 54,
REC_MASTERKEY);
@@ -2178,6 +2180,7 @@ static void _keystore_print_record(struct util_rec *rec,
char *description;
char *volume_type;
char *reencipher;
char *key_type;
char *creation;
char *volumes;
char *change;
@@ -2212,6 +2215,7 @@ static void _keystore_print_record(struct util_rec *rec,
reencipher = properties_get(properties, PROP_NAME_REENC_TIME);
vp = properties_get(properties, PROP_NAME_KEY_VP);
volume_type = _keystore_get_volume_type(properties);
key_type = properties_get(properties, PROP_NAME_KEY_TYPE);
util_rec_set(rec, REC_KEY, name);
if (validation)
@@ -2226,6 +2230,7 @@ static void _keystore_print_record(struct util_rec *rec,
util_rec_set(rec, REC_CLR_KEY_SIZE, "(unknown)");
util_rec_set(rec, REC_XTS,
IS_XTS(secure_key_size) ? "Yes" : "No");
util_rec_set(rec, REC_KEY_TYPE, key_type);
if (validation) {
if (valid)
util_rec_set(rec, REC_MASTERKEY,
@@ -2290,6 +2295,8 @@ static void _keystore_print_record(struct util_rec *rec,
free(vp);
if (volume_type != NULL)
free(volume_type);
if (key_type != NULL)
free(key_type);
}
struct validate_info {

39
zkey/pkey.c
View File

@@ -790,3 +790,42 @@ int get_master_key_verification_pattern(const u8 *secure_key,
return 0;
}
/**
* Check if the specified key is a CCA AESDATA key token.
*
* @param[in] key the secure key token
* @param[in] key_size the size of the secure key
*
* @returns true if the key is an CCA AESDATA token type
*/
bool is_cca_aes_data_key(const u8 *key, size_t key_size)
{
struct tokenheader *hdr = (struct tokenheader *)key;
if (key == NULL || key_size < SECURE_KEY_SIZE)
return false;
if (hdr->type != TOKEN_TYPE_CCA_INTERNAL)
return false;
if (hdr->version != TOKEN_VERSION_AESDATA)
return false;
return true;
}
/**
* Returns the type of the key
*
* @param[in] key the secure key token
* @param[in] key_size the size of the secure key
*
* @returns a static string on success, NULL in case of an error
*/
const char *get_key_type(const u8 *key, size_t key_size)
{
if (is_cca_aes_data_key(key, key_size))
return KEY_TYPE_CCA_AESDATA;
return NULL;
}

17
zkey/pkey.h
View File

@@ -18,6 +18,18 @@
/*
* Definitions for the /dev/pkey kernel module interface
*/
struct tokenheader {
u8 type;
u8 res0[3];
u8 version;
u8 res1[3];
} __packed;
#define TOKEN_TYPE_NON_CCA 0x00
#define TOKEN_TYPE_CCA_INTERNAL 0x01
#define TOKEN_VERSION_AESDATA 0x04
struct secaeskeytoken {
u8 type; /* 0x01 for internal key token */
u8 res0[3];
@@ -82,6 +94,8 @@ struct pkey_verifykey {
#define PKEY_VERIFYKEY _IOWR(PKEY_IOCTL_MAGIC, 0x07, struct pkey_verifykey)
#define KEY_TYPE_CCA_AESDATA "CCA-AESDATA"
#define PAES_BLOCK_SIZE 16
#define ENC_ZERO_LEN (2 * PAES_BLOCK_SIZE)
#define VERIFICATION_PATTERN_LEN (2 * ENC_ZERO_LEN + 1)
@@ -116,4 +130,7 @@ int get_master_key_verification_pattern(const u8 *secure_key,
size_t secure_key_size, u64 *mkvp,
bool verbose);
bool is_cca_aes_data_key(const u8 *key, size_t key_size);
const char *get_key_type(const u8 *key, size_t key_size);
#endif

2
zkey/zkey-cryptsetup.c
View File

@@ -1999,6 +1999,8 @@ static int command_validate(void)
printf(" Secure key size: %lu bytes\n", keysize);
printf(" XTS type key: %s\n",
keysize > SECURE_KEY_SIZE ? "Yes" : "No");
printf(" Key type: %s\n",
get_key_type((u8 *)key, keysize));
if (is_valid) {
printf(" Clear key size: %lu bits\n", clear_keysize);
printf(" Enciphered with: %s CCA master key (MKVP: "

2
zkey/zkey.c
View File

@@ -1416,6 +1416,8 @@ static int command_validate_file(void)
printf("Validation of secure key in file '%s':\n", g.pos_arg);
printf(" Status: Valid\n");
printf(" Secure key size: %lu bytes\n", secure_key_size);
printf(" Key type: %s\n",
get_key_type(secure_key, secure_key_size));
printf(" Clear key size: %lu bits\n", clear_key_size);
printf(" XTS type key: %s\n",
secure_key_size > SECURE_KEY_SIZE ? "Yes" : "No");